interpool trojaner

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 01-02-2014 03
Ran by SYSTEM on MININT-O7UPTIF on 03-02-2014 22:20:48
Running from F:\
Windows 7 Professional Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 8
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.



==================== Registry (Whitelisted) ==================

HKLM\...\Run: [HPCam_Menu] - C:\Program Files\Hewlett-Packard\HP Webcam\MUITransfer\MUIStartMenu.exe [218408 2009-02-25] (CyberLink Corp.)
HKLM\...\Run: [WatchDog] - C:\Program Files\InterVideo\DVD8SESD\DVDCheck.exe [200848 2009-04-03] (InterVideo Inc.)
HKLM\...\Run: [PDF Complete] - C:\Program Files\PDF Complete\pdfsty.exe [319000 2008-08-08] (PDF Complete Inc)
HKLM\...\Run: [SUPERDVR] - "C:\Program Files\PC DVR Guardian\PC DVR Guardian\SuperDVR.EXE" <AUTORUN>
HKLM\...\Run: [MobileConnect] - C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe [2412032 2009-09-18] (Vodafone)
HKLM\...\Run: [avast5] - C:\Program Files\Alwil Software\Avast5\avastUI.exe [2756488 2010-02-11] (ALWIL Software)
HKLM\...\Run: [Sepang Olivetti ModemListener] - C:\Program Files\Chiavetta Internet Olicard 200\BackgroundService\ModemListener.exe [106496 2010-07-23] ()
Startup: C:\Users\Hubert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7tfr0989.lnk
ShortcutTarget: 7tfr0989.lnk -> C:\ProgramData\9890rft7.jss (hxxp://tortoisesvn.net)
Startup: C:\Users\Hubert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\My Vodafone.it.lnk
ShortcutTarget: My Vodafone.it.lnk ->  (No File)

========================== Services (Whitelisted) =================

S2 avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [40384 2010-02-11] (ALWIL Software)
S3 avast! Mail Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [40384 2010-02-11] (ALWIL Software)
S3 avast! Web Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [40384 2010-02-11] (ALWIL Software)
S2 Olivetti Silverstone Modem Device Helper; C:\Program Files\Chiavetta Internet Olicard 200\BackgroundService\ServiceManager.exe [45056 2010-07-23] ()
S2 pdfcDispatcher; C:\Program Files\PDF Complete\pdfsvc.exe [777240 2008-08-08] (PDF Complete Inc)
S2 VMCService; C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe [9216 2009-09-18] (Vodafone)
S2 Winmgmt; C:\ProgramData\9890rft7.jss [260096 2013-12-19] (hxxp://tortoisesvn.net)

==================== Drivers (Whitelisted) ====================

S2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [19024 2010-02-11] (ALWIL Software)
S2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [51792 2010-02-11] (ALWIL Software)
S1 aswRdr; C:\Windows\System32\Drivers\aswRdr.sys [23376 2010-02-11] (ALWIL Software)
S1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [162512 2010-02-11] (ALWIL Software)
S1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [46672 2010-02-11] (ALWIL Software)
S3 jrdusbser; C:\Windows\System32\DRIVERS\jrdusbser.sys [105344 2010-08-16] (Olivetti)
S3 Olicard200net; C:\Windows\System32\DRIVERS\Olicard200Usbnet.sys [117760 2010-08-16] (Olivetti)
S3 ZTEusbnet; C:\Windows\System32\DRIVERS\ZTEusbnet.sys [114688 2009-08-18] (ZTE Corporation)
S3 ZTEusbvoice; C:\Windows\System32\DRIVERS\ZTEusbvoice.sys [105088 2009-08-18] (ZTE Incorporated)
S3 MREMP50; \??\C:\PROGRA~1\COMMON~1\Motive\MREMP50.SYS [x]
S3 MREMP50a64; \??\C:\PROGRA~1\COMMON~1\Motive\MREMP50a64.SYS [x]
S3 MREMPR5; \??\C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS [x]
S3 MRENDIS5; \??\C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS [x]
S3 MRESP50; \??\C:\PROGRA~1\COMMON~1\Motive\MRESP50.SYS [x]
S3 MRESP50a64; \??\C:\PROGRA~1\COMMON~1\Motive\MRESP50a64.SYS [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-02-03 22:20 - 2014-02-03 22:20 - 00000000 ____D () C:\FRST

==================== One Month Modified Files and Folders =======

2014-02-03 22:20 - 2014-02-03 22:20 - 00000000 ____D () C:\FRST
2014-02-03 22:17 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\System32\LogFiles
2014-02-03 22:00 - 2013-12-19 20:49 - 95025368 ____T () C:\ProgramData\7tfr0989.fee
2014-02-03 22:00 - 2013-12-19 20:49 - 00000000 _____ () C:\ProgramData\7tfr0989.odd
2014-02-03 21:59 - 2009-07-14 05:39 - 00047234 _____ () C:\Windows\setupact.log
2014-02-03 21:52 - 2010-02-12 19:39 - 01079169 _____ () C:\Windows\WindowsUpdate.log
2014-02-03 21:49 - 2009-07-14 05:34 - 00015712 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-02-03 21:49 - 2009-07-14 05:34 - 00015712 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-02-03 21:27 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-02-03 21:19 - 2010-02-12 19:43 - 01528472 _____ () C:\Windows\System32\PerfStringBackup.INI

Files to move or delete:
====================
C:\ProgramData\7tfr0989.fee
C:\ProgramData\7tfr0989.odd
C:\ProgramData\7tfr0989.reg
C:\ProgramData\9890rft7.jss


Some content of TEMP:
====================
C:\Users\Hubert\AppData\Local\Temp\qdg.dll
C:\Users\Hubert\AppData\Local\Temp\SpOrder.dll
C:\Users\Hubert\AppData\Local\Temp\_is848A.exe


==================== Known DLLs (Whitelisted) ============


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points  =========================

Restore point made on: 2011-05-31 19:42:44
Restore point made on: 2011-05-31 20:52:56
Restore point made on: 2011-06-22 19:07:45
Restore point made on: 2011-06-23 19:49:05
Restore point made on: 2011-06-26 08:53:40
Restore point made on: 2011-06-26 16:58:59
Restore point made on: 2011-08-09 21:07:01
Restore point made on: 2011-09-18 09:24:44
Restore point made on: 2012-07-15 20:17:53
Restore point made on: 2012-07-15 20:24:15
Restore point made on: 2013-01-25 22:04:41
Restore point made on: 2013-01-25 22:30:10
Restore point made on: 2013-07-25 14:32:06
Restore point made on: 2013-12-09 08:41:18
Restore point made on: 2013-12-09 13:07:28
Restore point made on: 2014-02-03 21:17:38

==================== Memory info ===========================

Percentage of memory in use: 13%
Total physical RAM: 4087.3 MB
Available physical RAM: 3554.63 MB
Total Pagefile: 4085.59 MB
Available Pagefile: 3558.78 MB
Total Virtual: 2047.88 MB
Available Virtual: 1940.88 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:297.99 GB) (Free:169.28 GB) NTFS
Drive e: (GSP1RMCSTFREO_DE_DVD) (CDROM) (Total:2.34 GB) (Free:0 GB) UDF
Drive f: () (Removable) (Total:0.24 GB) (Free:0.12 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (System-reserviert) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298 GB) (Disk ID: C38EA4DF)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=298 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 246 MB) (Disk ID: C3072E18)
Partition 1: (Not Active) - (Size=245 MB) - (Type=0B)


LastRegBack: 2013-12-09 08:35

==================== End Of Log ============================